DYN-10892 Update dependencies for GL 4.3

[edwin-vasquez-ucaldas]

Purpose

DYN-10892: Annual pre-Global-Launch refresh of NotificationCenter for Dynamo 4.3 (Civil 3D 2028 GL), following last year's #77.

Last cycle, 0.0.33 was published but Dynamo stayed on 0.0.31 (fixed in Dynamo #17382). This release (0.0.34) will also carry the ~70 commits merged since 0.0.33, including axios 1.20.0 and webpack-dev-server 6 / webpack-cli 7 (#120).

Changes

• Node 22 → 24 (current Active LTS) in build.yml and in both jobs of npm-publish.yml.
• Dependencies refreshed with npm update + npm audit fix (lockfile only, about 18k lines removed through deduplication). Every resolved URL still points at registry.npmjs.org.
• terser-webpack-plugin declared as a devDependency (^5.6.1). webpack.config.js requires it but never declared it. webpack 5.111 no longer pulls it in.
• overrides: { "cheerio": "1.0.0-rc.12" }. The unit test uses Enzyme 3.11 (unmaintained), which requires cheerio/lib/utils. cheerio removed that in 1.x final releases, and npm update had moved it to 1.2.0, breaking tests/unit/App.test.js. The override keeps the version that was already in the lockfile. It's test-only.
• License output regenerated (npm run generate_license).

Security

	Before	After
Total	50	48
Critical	0	0
High	40	41

The count barely moves because nearly everything left sits behind breaking majors in test tooling: Jest 28 → 30 (30 advisories), Puppeteer 22 → 25 (8) and jest-junit 14 → 17. For a few packages npm audit fix --force proposes downgrades, such as webpack-dev-server@1.14.1 and webpack-cli@6, so it must not be used. Tracked in DYN-11026.

npm audit fix only runs here with --legacy-peer-deps, because @dynamods/notifications-panel@0.0.10 declares a React 17 peer dependency (the HIG/Weave issue noted in #77). With the flag, it reports nothing further to fix.

Runtime impact

• react / react-dom 18.2.0 → 18.3.1.
• New build warnings: Sass "legacy JS API" deprecation notices from the newer sass. They're notices only, not errors.

Testing

Run locally on Node 24.15 / npm 11.12 from a clean npm ci --force:

• npm run build ✅
• npm run test: 10/10 suites (lint, unit, e2e/Puppeteer) ✅
• npm run production ✅

Release

• Bump version 0.0.33 → 0.0.34 with npm version patch --no-git-tag-version. Avoid npm run version:patch: its postversion hook auto-commits.
• After merge, create GitHub Release v0.0.34 to publish to npm
• Bump the Dynamo pin in src/Notifications/Notifications.csproj from 0.0.33 (#17382) to 0.0.34

🤖 Generated with Claude Code

[jasonstratton]

LGTM